CVE-2025-54433

Description

## Summary In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary. ## Impact A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. ## Mitigation Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.

How to fix CVE-2025-54433

To remediate CVE-2025-54433, upgrade the affected package to a fixed version below.

• —upgrade to 1.7.4 or later

Is CVE-2025-54433 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 1.7.0, < 1.7.4

CVSS scores

References (11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-54433
• PATCHgithub.com/bugsink/bugsink
• WEBgithub.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33
• WEBgithub.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21